@xopcai/xopc 0.0.101 → 0.0.103

package/dist/src/auth/oauth/vendor-pi-google/google-antigravity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"google-antigravity.js","names":[],"sources":["../../../../../src/auth/oauth/vendor-pi-google/google-antigravity.ts"],"sourcesContent":["/**\n * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)\n * Uses different OAuth credentials than google-gemini-cli for access to additional models.\n *\n * NOTE: This module uses Node.js http.createServer for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\nimport type { Server } from \"node:http\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.js\";\nimport { generatePKCE } from \"./pkce.js\";\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from \"../types.js\";\n\ntype AntigravityCredentials = OAuthCredentials & {\n\tprojectId: string;\n};\n\nlet _createServer: typeof import(\"node:http\").createServer | null = null;\nlet _httpImportPromise: Promise<void> | null = null;\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\t_httpImportPromise = import(\"node:http\").then((m) => {\n\t\t_createServer = m.createServer;\n\t});\n}\n\nconst ANTIGRAVITY_CLIENT_ID_ENV = 'XOPC_GOOGLE_ANTIGRAVITY_OAUTH_CLIENT_ID';\nconst ANTIGRAVITY_CLIENT_SECRET_ENV = 'XOPC_GOOGLE_ANTIGRAVITY_OAUTH_CLIENT_SECRET';\n\n/** Desktop OAuth client for this flow — must be set locally (not committed; avoids GitHub push protection). */\nfunction getAntigravityOAuthClient(): { clientId: string; clientSecret: string } {\n\tconst clientId = process.env[ANTIGRAVITY_CLIENT_ID_ENV]?.trim();\n\tconst clientSecret = process.env[ANTIGRAVITY_CLIENT_SECRET_ENV]?.trim();\n\tif (!clientId || !clientSecret) {\n\t\tthrow new Error(\n\t\t\t`Google Antigravity OAuth requires ${ANTIGRAVITY_CLIENT_ID_ENV} and ${ANTIGRAVITY_CLIENT_SECRET_ENV}.`,\n\t\t);\n\t}\n\treturn { clientId, clientSecret };\n}\n\nconst REDIRECT_URI = \"http://localhost:51121/oauth-callback\";\n\n// Antigravity requires additional scopes\nconst SCOPES = [\n\t\"https://www.googleapis.com/auth/cloud-platform\",\n\t\"https://www.googleapis.com/auth/userinfo.email\",\n\t\"https://www.googleapis.com/auth/userinfo.profile\",\n\t\"https://www.googleapis.com/auth/cclog\",\n\t\"https://www.googleapis.com/auth/experimentsandconfigs\",\n];\n\nconst AUTH_URL = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_URL = \"https://oauth2.googleapis.com/token\";\n\n// Fallback project ID when discovery fails\nconst DEFAULT_PROJECT_ID = \"rising-fact-p41fc\";\n\ntype CallbackServerInfo = {\n\tserver: Server;\n\tcancelWait: () => void;\n\twaitForCode: () => Promise<{ code: string; state: string } | null>;\n};\n\n/**\n * Start a local HTTP server to receive the OAuth callback\n */\nasync function getNodeCreateServer(): Promise<typeof import(\"node:http\").createServer> {\n\tif (_createServer) return _createServer;\n\tif (_httpImportPromise) {\n\t\tawait _httpImportPromise;\n\t}\n\tif (_createServer) return _createServer;\n\tthrow new Error(\"Antigravity OAuth is only available in Node.js environments\");\n}\n\nasync function startCallbackServer(): Promise<CallbackServerInfo> {\n\tconst createServer = await getNodeCreateServer();\n\n\treturn new Promise((resolve, reject) => {\n\t\tlet settleWait: ((value: { code: string; state: string } | null) => void) | undefined;\n\t\tconst waitForCodePromise = new Promise<{ code: string; state: string } | null>((resolveWait) => {\n\t\t\tlet settled = false;\n\t\t\tsettleWait = (value) => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tresolveWait(value);\n\t\t\t};\n\t\t});\n\n\t\tconst server = createServer((req, res) => {\n\t\t\tconst url = new URL(req.url || \"\", `http://localhost:51121`);\n\n\t\t\tif (url.pathname === \"/oauth-callback\") {\n\t\t\t\tconst code = url.searchParams.get(\"code\");\n\t\t\t\tconst state = url.searchParams.get(\"state\");\n\t\t\t\tconst error = url.searchParams.get(\"error\");\n\n\t\t\t\tif (error) {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Google authentication did not complete.\", `Error: ${error}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (code && state) {\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthSuccessHtml(\"Google authentication completed. You can close this window.\"));\n\t\t\t\t\tsettleWait?.({ code, state });\n\t\t\t\t} else {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Missing code or state parameter.\"));\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tres.writeHead(404, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(oauthErrorHtml(\"Callback route not found.\"));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (err) => {\n\t\t\treject(err);\n\t\t});\n\n\t\tserver.listen(51121, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tcancelWait: () => {\n\t\t\t\t\tsettleWait?.(null);\n\t\t\t\t},\n\t\t\t\twaitForCode: () => waitForCodePromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Parse redirect URL to extract code and state\n */\nfunction parseRedirectUrl(input: string): { code?: string; state?: string } {\n\tconst value = input.trim();\n\tif (!value) return {};\n\n\ttry {\n\t\tconst url = new URL(value);\n\t\treturn {\n\t\t\tcode: url.searchParams.get(\"code\") ?? undefined,\n\t\t\tstate: url.searchParams.get(\"state\") ?? undefined,\n\t\t};\n\t} catch {\n\t\t// Not a URL, return empty\n\t\treturn {};\n\t}\n}\n\ninterface LoadCodeAssistPayload {\n\tcloudaicompanionProject?: string | { id?: string };\n\tcurrentTier?: { id?: string };\n\tallowedTiers?: Array<{ id?: string; isDefault?: boolean }>;\n}\n\n/**\n * Discover or provision a project for the user\n */\nasync function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {\n\tconst headers = {\n\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\"Content-Type\": \"application/json\",\n\t\t\"User-Agent\": \"google-api-nodejs-client/9.15.1\",\n\t\t\"X-Goog-Api-Client\": \"google-cloud-sdk vscode_cloudshelleditor/0.1\",\n\t\t\"Client-Metadata\": JSON.stringify({\n\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\tpluginType: \"GEMINI\",\n\t\t}),\n\t};\n\n\t// Try endpoints in order: prod first, then sandbox\n\tconst endpoints = [\"https://cloudcode-pa.googleapis.com\", \"https://daily-cloudcode-pa.sandbox.googleapis.com\"];\n\n\tonProgress?.(\"Checking for existing project...\");\n\n\tfor (const endpoint of endpoints) {\n\t\ttry {\n\t\t\tconst loadResponse = await fetch(`${endpoint}/v1internal:loadCodeAssist`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\t\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\t\t\t\tpluginType: \"GEMINI\",\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (loadResponse.ok) {\n\t\t\t\tconst data = (await loadResponse.json()) as LoadCodeAssistPayload;\n\n\t\t\t\t// Handle both string and object formats\n\t\t\t\tif (typeof data.cloudaicompanionProject === \"string\" && data.cloudaicompanionProject) {\n\t\t\t\t\treturn data.cloudaicompanionProject;\n\t\t\t\t}\n\t\t\t\tif (\n\t\t\t\t\tdata.cloudaicompanionProject &&\n\t\t\t\t\ttypeof data.cloudaicompanionProject === \"object\" &&\n\t\t\t\t\tdata.cloudaicompanionProject.id\n\t\t\t\t) {\n\t\t\t\t\treturn data.cloudaicompanionProject.id;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Try next endpoint\n\t\t}\n\t}\n\n\t// Use fallback project ID\n\tonProgress?.(\"Using default project...\");\n\treturn DEFAULT_PROJECT_ID;\n}\n\n/**\n * Get user email from the access token\n */\nasync function getUserEmail(accessToken: string): Promise<string | undefined> {\n\ttry {\n\t\tconst response = await fetch(\"https://www.googleapis.com/oauth2/v1/userinfo?alt=json\", {\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\t},\n\t\t});\n\n\t\tif (response.ok) {\n\t\t\tconst data = (await response.json()) as { email?: string };\n\t\t\treturn data.email;\n\t\t}\n\t} catch {\n\t\t// Ignore errors, email is optional\n\t}\n\treturn undefined;\n}\n\n/**\n * Refresh Antigravity token\n */\nexport async function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {\n\tconst { clientId, clientSecret } = getAntigravityOAuthClient();\n\tconst response = await fetch(TOKEN_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tclient_secret: clientSecret,\n\t\t\trefresh_token: refreshToken,\n\t\t\tgrant_type: \"refresh_token\",\n\t\t}),\n\t});\n\n\tif (!response.ok) {\n\t\tconst error = await response.text();\n\t\tthrow new Error(`Antigravity token refresh failed: ${error}`);\n\t}\n\n\tconst data = (await response.json()) as {\n\t\taccess_token: string;\n\t\texpires_in: number;\n\t\trefresh_token?: string;\n\t};\n\n\treturn {\n\t\trefresh: data.refresh_token || refreshToken,\n\t\taccess: data.access_token,\n\t\texpires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n\t\tprojectId,\n\t};\n}\n\n/**\n * Login with Antigravity OAuth\n *\n * @param onAuth - Callback with URL and optional instructions\n * @param onProgress - Optional progress callback\n * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.\n *                            Races with browser callback - whichever completes first wins.\n */\nexport async function loginAntigravity(\n\tonAuth: (info: { url: string; instructions?: string }) => void,\n\tonProgress?: (message: string) => void,\n\tonManualCodeInput?: () => Promise<string>,\n): Promise<OAuthCredentials> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst { clientId, clientSecret } = getAntigravityOAuthClient();\n\n\t// Start local server for callback\n\tonProgress?.(\"Starting local server for OAuth callback...\");\n\tconst server = await startCallbackServer();\n\n\tlet code: string | undefined;\n\n\ttry {\n\t\t// Build authorization URL\n\t\tconst authParams = new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tresponse_type: \"code\",\n\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\tscope: SCOPES.join(\" \"),\n\t\t\tcode_challenge: challenge,\n\t\t\tcode_challenge_method: \"S256\",\n\t\t\tstate: verifier,\n\t\t\taccess_type: \"offline\",\n\t\t\tprompt: \"consent\",\n\t\t});\n\n\t\tconst authUrl = `${AUTH_URL}?${authParams.toString()}`;\n\n\t\t// Notify caller with URL to open\n\t\tonAuth({\n\t\t\turl: authUrl,\n\t\t\tinstructions: \"Complete the sign-in in your browser.\",\n\t\t});\n\n\t\t// Wait for the callback, racing with manual input if provided\n\t\tonProgress?.(\"Waiting for OAuth callback...\");\n\n\t\tif (onManualCodeInput) {\n\t\t\t// Race between browser callback and manual input\n\t\t\tlet manualInput: string | undefined;\n\t\t\tlet manualError: Error | undefined;\n\t\t\tconst manualPromise = onManualCodeInput()\n\t\t\t\t.then((input) => {\n\t\t\t\t\tmanualInput = input;\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t})\n\t\t\t\t.catch((err) => {\n\t\t\t\t\tmanualError = err instanceof Error ? err : new Error(String(err));\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t});\n\n\t\t\tconst result = await server.waitForCode();\n\n\t\t\t// If manual input was cancelled, throw that error\n\t\t\tif (manualError) {\n\t\t\t\tthrow manualError;\n\t\t\t}\n\n\t\t\tif (result?.code) {\n\t\t\t\t// Browser callback won - verify state\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t} else if (manualInput) {\n\t\t\t\t// Manual input won\n\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = parsed.code;\n\t\t\t}\n\n\t\t\t// If still no code, wait for manual promise and try that\n\t\t\tif (!code) {\n\t\t\t\tawait manualPromise;\n\t\t\t\tif (manualError) {\n\t\t\t\t\tthrow manualError;\n\t\t\t\t}\n\t\t\t\tif (manualInput) {\n\t\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t\t}\n\t\t\t\t\tcode = parsed.code;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\t// Original flow: just wait for callback\n\t\t\tconst result = await server.waitForCode();\n\t\t\tif (result?.code) {\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t}\n\t\t}\n\n\t\tif (!code) {\n\t\t\tthrow new Error(\"No authorization code received\");\n\t\t}\n\n\t\t// Exchange code for tokens\n\t\tonProgress?.(\"Exchanging authorization code for tokens...\");\n\t\tconst tokenResponse = await fetch(TOKEN_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: clientId,\n\t\t\t\tclient_secret: clientSecret,\n\t\t\t\tcode,\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tif (!tokenData.refresh_token) {\n\t\t\tthrow new Error(\"No refresh token received. Please try again.\");\n\t\t}\n\n\t\t// Get user email\n\t\tonProgress?.(\"Getting user info...\");\n\t\tconst email = await getUserEmail(tokenData.access_token);\n\n\t\t// Discover project\n\t\tconst projectId = await discoverProject(tokenData.access_token, onProgress);\n\n\t\t// Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n\t\tconst expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\taccess: tokenData.access_token,\n\t\t\texpires: expiresAt,\n\t\t\tprojectId,\n\t\t\temail,\n\t\t};\n\n\t\treturn credentials;\n\t} finally {\n\t\tserver.server.close();\n\t}\n}\n\nexport const antigravityOAuthProvider: OAuthProviderInterface = {\n\tid: \"google-antigravity\",\n\tname: \"Antigravity (Gemini 3, Claude, GPT-OSS)\",\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\treturn loginAntigravity(callbacks.onAuth, callbacks.onProgress, callbacks.onManualCodeInput);\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tconst creds = credentials as AntigravityCredentials;\n\t\tif (!creds.projectId) {\n\t\t\tthrow new Error(\"Antigravity credentials missing projectId\");\n\t\t}\n\t\treturn refreshAntigravityToken(creds.refresh, creds.projectId);\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\tconst creds = credentials as AntigravityCredentials;\n\t\treturn JSON.stringify({ token: creds.access, projectId: creds.projectId });\n\t},\n};\n"],"mappings":";;;AAiBA,IAAI,gBAAgE;AACpE,IAAI,qBAA2C;AAC/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,KAClF,sBAAqB,OAAO,aAAa,MAAM,MAAM;AACpD,iBAAgB,EAAE;EACjB;AAGH,MAAM,4BAA4B;AAClC,MAAM,gCAAgC;;AAGtC,SAAS,4BAAwE;CAChF,MAAM,WAAW,QAAQ,IAAI,4BAA4B,MAAM;CAC/D,MAAM,eAAe,QAAQ,IAAI,gCAAgC,MAAM;AACvE,KAAI,CAAC,YAAY,CAAC,aACjB,OAAM,IAAI,MACT,qCAAqC,0BAA0B,OAAO,8BAA8B,GACpG;AAEF,QAAO;EAAE;EAAU;EAAc;;AAGlC,MAAM,eAAe;AAGrB,MAAM,SAAS;CACd;CACA;CACA;CACA;CACA;CACA;AAED,MAAM,WAAW;AACjB,MAAM,YAAY;AAGlB,MAAM,qBAAqB;;;;AAW3B,eAAe,sBAAwE;AACtF,KAAI,cAAe,QAAO;AAC1B,KAAI,mBACH,OAAM;AAEP,KAAI,cAAe,QAAO;AAC1B,OAAM,IAAI,MAAM,8DAA8D;;AAG/E,eAAe,sBAAmD;CACjE,MAAM,eAAe,MAAM,qBAAqB;AAEhD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI;EACJ,MAAM,qBAAqB,IAAI,SAAiD,gBAAgB;GAC/F,IAAI,UAAU;AACd,iBAAc,UAAU;AACvB,QAAI,QAAS;AACb,cAAU;AACV,gBAAY,MAAM;;IAElB;EAEF,MAAM,SAAS,cAAc,KAAK,QAAQ;GACzC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,yBAAyB;AAE5D,OAAI,IAAI,aAAa,mBAAmB;IACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;IACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;IAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,QAAI,OAAO;AACV,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,2CAA2C,UAAU,QAAQ,CAAC;AACrF;;AAGD,QAAI,QAAQ,OAAO;AAClB,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,iBAAiB,8DAA8D,CAAC;AACxF,kBAAa;MAAE;MAAM;MAAO,CAAC;WACvB;AACN,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,mCAAmC,CAAC;;UAEtD;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI,eAAe,4BAA4B,CAAC;;IAEpD;AAEF,SAAO,GAAG,UAAU,QAAQ;AAC3B,UAAO,IAAI;IACV;AAEF,SAAO,OAAO,OAAO,mBAAmB;AACvC,WAAQ;IACP;IACA,kBAAkB;AACjB,kBAAa,KAAK;;IAEnB,mBAAmB;IACnB,CAAC;IACD;GACD;;;;;AAMH,SAAS,iBAAiB,OAAkD;CAC3E,MAAM,QAAQ,MAAM,MAAM;AAC1B,KAAI,CAAC,MAAO,QAAO,EAAE;AAErB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,SAAO;GACN,MAAM,IAAI,aAAa,IAAI,OAAO,IAAI,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,KAAA;GACxC;SACM;AAEP,SAAO,EAAE;;;;;;AAaX,eAAe,gBAAgB,aAAqB,YAAyD;CAC5G,MAAM,UAAU;EACf,eAAe,UAAU;EACzB,gBAAgB;EAChB,cAAc;EACd,qBAAqB;EACrB,mBAAmB,KAAK,UAAU;GACjC,SAAS;GACT,UAAU;GACV,YAAY;GACZ,CAAC;EACF;CAGD,MAAM,YAAY,CAAC,uCAAuC,oDAAoD;AAE9G,cAAa,mCAAmC;AAEhD,MAAK,MAAM,YAAY,UACtB,KAAI;EACH,MAAM,eAAe,MAAM,MAAM,GAAG,SAAS,6BAA6B;GACzE,QAAQ;GACR;GACA,MAAM,KAAK,UAAU,EACpB,UAAU;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,EACD,CAAC;GACF,CAAC;AAEF,MAAI,aAAa,IAAI;GACpB,MAAM,OAAQ,MAAM,aAAa,MAAM;AAGvC,OAAI,OAAO,KAAK,4BAA4B,YAAY,KAAK,wBAC5D,QAAO,KAAK;AAEb,OACC,KAAK,2BACL,OAAO,KAAK,4BAA4B,YACxC,KAAK,wBAAwB,GAE7B,QAAO,KAAK,wBAAwB;;SAG/B;AAMT,cAAa,2BAA2B;AACxC,QAAO;;;;;AAMR,eAAe,aAAa,aAAkD;AAC7E,KAAI;EACH,MAAM,WAAW,MAAM,MAAM,0DAA0D,EACtF,SAAS,EACR,eAAe,UAAU,eACzB,EACD,CAAC;AAEF,MAAI,SAAS,GAEZ,SAAO,MADa,SAAS,MAAM,EACvB;SAEN;;;;;AAST,eAAsB,wBAAwB,cAAsB,WAA8C;CACjH,MAAM,EAAE,UAAU,iBAAiB,2BAA2B;CAC9D,MAAM,WAAW,MAAM,MAAM,WAAW;EACvC,QAAQ;EACR,SAAS,EAAE,gBAAgB,qCAAqC;EAChE,MAAM,IAAI,gBAAgB;GACzB,WAAW;GACX,eAAe;GACf,eAAe;GACf,YAAY;GACZ,CAAC;EACF,CAAC;AAEF,KAAI,CAAC,SAAS,IAAI;EACjB,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAM,IAAI,MAAM,qCAAqC,QAAQ;;CAG9D,MAAM,OAAQ,MAAM,SAAS,MAAM;AAMnC,QAAO;EACN,SAAS,KAAK,iBAAiB;EAC/B,QAAQ,KAAK;EACb,SAAS,KAAK,KAAK,GAAG,KAAK,aAAa,MAAO,MAAS;EACxD;EACA;;;;;;;;;;AAWF,eAAsB,iBACrB,QACA,YACA,mBAC4B;CAC5B,MAAM,EAAE,UAAU,cAAc,MAAM,cAAc;CACpD,MAAM,EAAE,UAAU,iBAAiB,2BAA2B;AAG9D,cAAa,8CAA8C;CAC3D,MAAM,SAAS,MAAM,qBAAqB;CAE1C,IAAI;AAEJ,KAAI;AAiBH,SAAO;GACN,KAAK,GAJa,SAAS,GAAG,IAZR,gBAAgB;IACtC,WAAW;IACX,eAAe;IACf,cAAc;IACd,OAAO,OAAO,KAAK,IAAI;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,aAAa;IACb,QAAQ;IACR,CAEwC,CAAC,UAAU;GAKnD,cAAc;GACd,CAAC;AAGF,eAAa,gCAAgC;AAE7C,MAAI,mBAAmB;GAEtB,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,mBAAmB,CACvC,MAAM,UAAU;AAChB,kBAAc;AACd,WAAO,YAAY;KAClB,CACD,OAAO,QAAQ;AACf,kBAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACjE,WAAO,YAAY;KAClB;GAEH,MAAM,SAAS,MAAM,OAAO,aAAa;AAGzC,OAAI,YACH,OAAM;AAGP,OAAI,QAAQ,MAAM;AAEjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;cACJ,aAAa;IAEvB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,QAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;AAIf,OAAI,CAAC,MAAM;AACV,UAAM;AACN,QAAI,YACH,OAAM;AAEP,QAAI,aAAa;KAChB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,SAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,YAAO,OAAO;;;SAGV;GAEN,MAAM,SAAS,MAAM,OAAO,aAAa;AACzC,OAAI,QAAQ,MAAM;AACjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;;AAIhB,MAAI,CAAC,KACJ,OAAM,IAAI,MAAM,iCAAiC;AAIlD,eAAa,8CAA8C;EAC3D,MAAM,gBAAgB,MAAM,MAAM,WAAW;GAC5C,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,eAAe;IACf;IACA,YAAY;IACZ,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,MAAI,CAAC,UAAU,cACd,OAAM,IAAI,MAAM,+CAA+C;AAIhE,eAAa,uBAAuB;EACpC,MAAM,QAAQ,MAAM,aAAa,UAAU,aAAa;EAGxD,MAAM,YAAY,MAAM,gBAAgB,UAAU,cAAc,WAAW;EAG3E,MAAM,YAAY,KAAK,KAAK,GAAG,UAAU,aAAa,MAAO,MAAS;AAUtE,SAAO;GAPN,SAAS,UAAU;GACnB,QAAQ,UAAU;GAClB,SAAS;GACT;GACA;GAGiB;WACT;AACT,SAAO,OAAO,OAAO;;;AAIvB,MAAa,2BAAmD;CAC/D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;AACtE,SAAO,iBAAiB,UAAU,QAAQ,UAAU,YAAY,UAAU,kBAAkB;;CAG7F,MAAM,aAAa,aAA0D;EAC5E,MAAM,QAAQ;AACd,MAAI,CAAC,MAAM,UACV,OAAM,IAAI,MAAM,4CAA4C;AAE7D,SAAO,wBAAwB,MAAM,SAAS,MAAM,UAAU;;CAG/D,UAAU,aAAuC;EAChD,MAAM,QAAQ;AACd,SAAO,KAAK,UAAU;GAAE,OAAO,MAAM;GAAQ,WAAW,MAAM;GAAW,CAAC;;CAE3E"}

package/dist/src/auth/oauth/vendor-pi-google/google-gemini-cli.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"google-gemini-cli.js","names":[],"sources":["../../../../../src/auth/oauth/vendor-pi-google/google-gemini-cli.ts"],"sourcesContent":["/**\n * Gemini CLI OAuth flow (Google Cloud Code Assist)\n * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)\n *\n * NOTE: This module uses Node.js http.createServer for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\nimport type { Server } from \"node:http\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.js\";\nimport { generatePKCE } from \"./pkce.js\";\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from \"../types.js\";\n\ntype GeminiCredentials = OAuthCredentials & {\n\tprojectId: string;\n};\n\nlet _createServer: typeof import(\"node:http\").createServer | null = null;\nlet _httpImportPromise: Promise<void> | null = null;\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\t_httpImportPromise = import(\"node:http\").then((m) => {\n\t\t_createServer = m.createServer;\n\t});\n}\n\nconst GEMINI_CLI_CLIENT_ID_ENV = 'XOPC_GOOGLE_GEMINI_CLI_OAUTH_CLIENT_ID';\nconst GEMINI_CLI_CLIENT_SECRET_ENV = 'XOPC_GOOGLE_GEMINI_CLI_OAUTH_CLIENT_SECRET';\n\nfunction getGeminiCliOAuthClient(): { clientId: string; clientSecret: string } {\n\tconst clientId = process.env[GEMINI_CLI_CLIENT_ID_ENV]?.trim();\n\tconst clientSecret = process.env[GEMINI_CLI_CLIENT_SECRET_ENV]?.trim();\n\tif (!clientId || !clientSecret) {\n\t\tthrow new Error(\n\t\t\t`Google Gemini CLI OAuth requires ${GEMINI_CLI_CLIENT_ID_ENV} and ${GEMINI_CLI_CLIENT_SECRET_ENV}.`,\n\t\t);\n\t}\n\treturn { clientId, clientSecret };\n}\n\nconst REDIRECT_URI = \"http://localhost:8085/oauth2callback\";\nconst SCOPES = [\n\t\"https://www.googleapis.com/auth/cloud-platform\",\n\t\"https://www.googleapis.com/auth/userinfo.email\",\n\t\"https://www.googleapis.com/auth/userinfo.profile\",\n];\nconst AUTH_URL = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_URL = \"https://oauth2.googleapis.com/token\";\nconst CODE_ASSIST_ENDPOINT = \"https://cloudcode-pa.googleapis.com\";\n\ntype CallbackServerInfo = {\n\tserver: Server;\n\tcancelWait: () => void;\n\twaitForCode: () => Promise<{ code: string; state: string } | null>;\n};\n\n/**\n * Start a local HTTP server to receive the OAuth callback\n */\nasync function getNodeCreateServer(): Promise<typeof import(\"node:http\").createServer> {\n\tif (_createServer) return _createServer;\n\tif (_httpImportPromise) {\n\t\tawait _httpImportPromise;\n\t}\n\tif (_createServer) return _createServer;\n\tthrow new Error(\"Gemini CLI OAuth is only available in Node.js environments\");\n}\n\nasync function startCallbackServer(): Promise<CallbackServerInfo> {\n\tconst createServer = await getNodeCreateServer();\n\n\treturn new Promise((resolve, reject) => {\n\t\tlet settleWait: ((value: { code: string; state: string } | null) => void) | undefined;\n\t\tconst waitForCodePromise = new Promise<{ code: string; state: string } | null>((resolveWait) => {\n\t\t\tlet settled = false;\n\t\t\tsettleWait = (value) => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tresolveWait(value);\n\t\t\t};\n\t\t});\n\n\t\tconst server = createServer((req, res) => {\n\t\t\tconst url = new URL(req.url || \"\", `http://localhost:8085`);\n\n\t\t\tif (url.pathname === \"/oauth2callback\") {\n\t\t\t\tconst code = url.searchParams.get(\"code\");\n\t\t\t\tconst state = url.searchParams.get(\"state\");\n\t\t\t\tconst error = url.searchParams.get(\"error\");\n\n\t\t\t\tif (error) {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Google authentication did not complete.\", `Error: ${error}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (code && state) {\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthSuccessHtml(\"Google authentication completed. You can close this window.\"));\n\t\t\t\t\tsettleWait?.({ code, state });\n\t\t\t\t} else {\n\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\t\tres.end(oauthErrorHtml(\"Missing code or state parameter.\"));\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tres.writeHead(404, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(oauthErrorHtml(\"Callback route not found.\"));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (err) => {\n\t\t\treject(err);\n\t\t});\n\n\t\tserver.listen(8085, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tcancelWait: () => {\n\t\t\t\t\tsettleWait?.(null);\n\t\t\t\t},\n\t\t\t\twaitForCode: () => waitForCodePromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\n/**\n * Parse redirect URL to extract code and state\n */\nfunction parseRedirectUrl(input: string): { code?: string; state?: string } {\n\tconst value = input.trim();\n\tif (!value) return {};\n\n\ttry {\n\t\tconst url = new URL(value);\n\t\treturn {\n\t\t\tcode: url.searchParams.get(\"code\") ?? undefined,\n\t\t\tstate: url.searchParams.get(\"state\") ?? undefined,\n\t\t};\n\t} catch {\n\t\t// Not a URL, return empty\n\t\treturn {};\n\t}\n}\n\ninterface LoadCodeAssistPayload {\n\tcloudaicompanionProject?: string;\n\tcurrentTier?: { id?: string };\n\tallowedTiers?: Array<{ id?: string; isDefault?: boolean }>;\n}\n\n/**\n * Long-running operation response from onboardUser\n */\ninterface LongRunningOperationResponse {\n\tname?: string;\n\tdone?: boolean;\n\tresponse?: {\n\t\tcloudaicompanionProject?: { id?: string };\n\t};\n}\n\n// Tier IDs as used by the Cloud Code API\nconst TIER_FREE = \"free-tier\";\nconst TIER_LEGACY = \"legacy-tier\";\nconst TIER_STANDARD = \"standard-tier\";\n\ninterface GoogleRpcErrorResponse {\n\terror?: {\n\t\tdetails?: Array<{ reason?: string }>;\n\t};\n}\n\n/**\n * Wait helper for onboarding retries\n */\nfunction wait(ms: number): Promise<void> {\n\treturn new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Get default tier from allowed tiers\n */\nfunction getDefaultTier(allowedTiers?: Array<{ id?: string; isDefault?: boolean }>): { id?: string } {\n\tif (!allowedTiers || allowedTiers.length === 0) return { id: TIER_LEGACY };\n\tconst defaultTier = allowedTiers.find((t) => t.isDefault);\n\treturn defaultTier ?? { id: TIER_LEGACY };\n}\n\nfunction isVpcScAffectedUser(payload: unknown): boolean {\n\tif (!payload || typeof payload !== \"object\") return false;\n\tif (!(\"error\" in payload)) return false;\n\tconst error = (payload as GoogleRpcErrorResponse).error;\n\tif (!error?.details || !Array.isArray(error.details)) return false;\n\treturn error.details.some((detail) => detail.reason === \"SECURITY_POLICY_VIOLATED\");\n}\n\n/**\n * Poll a long-running operation until completion\n */\nasync function pollOperation(\n\toperationName: string,\n\theaders: Record<string, string>,\n\tonProgress?: (message: string) => void,\n): Promise<LongRunningOperationResponse> {\n\tlet attempt = 0;\n\twhile (true) {\n\t\tif (attempt > 0) {\n\t\t\tonProgress?.(`Waiting for project provisioning (attempt ${attempt + 1})...`);\n\t\t\tawait wait(5000);\n\t\t}\n\n\t\tconst response = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal/${operationName}`, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to poll operation: ${response.status} ${response.statusText}`);\n\t\t}\n\n\t\tconst data = (await response.json()) as LongRunningOperationResponse;\n\t\tif (data.done) {\n\t\t\treturn data;\n\t\t}\n\n\t\tattempt += 1;\n\t}\n}\n\n/**\n * Discover or provision a Google Cloud project for the user\n */\nasync function discoverProject(accessToken: string, onProgress?: (message: string) => void): Promise<string> {\n\t// Check for user-provided project ID via environment variable\n\tconst envProjectId = process.env.GOOGLE_CLOUD_PROJECT || process.env.GOOGLE_CLOUD_PROJECT_ID;\n\n\tconst headers = {\n\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\"Content-Type\": \"application/json\",\n\t\t\"User-Agent\": \"google-api-nodejs-client/9.15.1\",\n\t\t\"X-Goog-Api-Client\": \"gl-node/22.17.0\",\n\t};\n\n\t// Try to load existing project via loadCodeAssist\n\tonProgress?.(\"Checking for existing Cloud Code Assist project...\");\n\tconst loadResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:loadCodeAssist`, {\n\t\tmethod: \"POST\",\n\t\theaders,\n\t\tbody: JSON.stringify({\n\t\t\tcloudaicompanionProject: envProjectId,\n\t\t\tmetadata: {\n\t\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\t\tpluginType: \"GEMINI\",\n\t\t\t\tduetProject: envProjectId,\n\t\t\t},\n\t\t}),\n\t});\n\n\tlet data: LoadCodeAssistPayload;\n\n\tif (!loadResponse.ok) {\n\t\tlet errorPayload: unknown;\n\t\ttry {\n\t\t\terrorPayload = await loadResponse.clone().json();\n\t\t} catch {\n\t\t\terrorPayload = undefined;\n\t\t}\n\n\t\tif (isVpcScAffectedUser(errorPayload)) {\n\t\t\tdata = { currentTier: { id: TIER_STANDARD } };\n\t\t} else {\n\t\t\tconst errorText = await loadResponse.text();\n\t\t\tthrow new Error(`loadCodeAssist failed: ${loadResponse.status} ${loadResponse.statusText}: ${errorText}`);\n\t\t}\n\t} else {\n\t\tdata = (await loadResponse.json()) as LoadCodeAssistPayload;\n\t}\n\n\t// If user already has a current tier and project, use it\n\tif (data.currentTier) {\n\t\tif (data.cloudaicompanionProject) {\n\t\t\treturn data.cloudaicompanionProject;\n\t\t}\n\t\t// User has a tier but no managed project - they need to provide one via env var\n\t\tif (envProjectId) {\n\t\t\treturn envProjectId;\n\t\t}\n\t\tthrow new Error(\n\t\t\t\"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t\t);\n\t}\n\n\t// User needs to be onboarded - get the default tier\n\tconst tier = getDefaultTier(data.allowedTiers);\n\tconst tierId = tier?.id ?? TIER_FREE;\n\n\tif (tierId !== TIER_FREE && !envProjectId) {\n\t\tthrow new Error(\n\t\t\t\"This account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t\t);\n\t}\n\n\tonProgress?.(\"Provisioning Cloud Code Assist project (this may take a moment)...\");\n\n\t// Build onboard request - for free tier, don't include project ID (Google provisions one)\n\t// For other tiers, include the user's project ID if available\n\tconst onboardBody: Record<string, unknown> = {\n\t\ttierId,\n\t\tmetadata: {\n\t\t\tideType: \"IDE_UNSPECIFIED\",\n\t\t\tplatform: \"PLATFORM_UNSPECIFIED\",\n\t\t\tpluginType: \"GEMINI\",\n\t\t},\n\t};\n\n\tif (tierId !== TIER_FREE && envProjectId) {\n\t\tonboardBody.cloudaicompanionProject = envProjectId;\n\t\t(onboardBody.metadata as Record<string, unknown>).duetProject = envProjectId;\n\t}\n\n\t// Start onboarding - this returns a long-running operation\n\tconst onboardResponse = await fetch(`${CODE_ASSIST_ENDPOINT}/v1internal:onboardUser`, {\n\t\tmethod: \"POST\",\n\t\theaders,\n\t\tbody: JSON.stringify(onboardBody),\n\t});\n\n\tif (!onboardResponse.ok) {\n\t\tconst errorText = await onboardResponse.text();\n\t\tthrow new Error(`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`);\n\t}\n\n\tlet lroData = (await onboardResponse.json()) as LongRunningOperationResponse;\n\n\t// If the operation isn't done yet, poll until completion\n\tif (!lroData.done && lroData.name) {\n\t\tlroData = await pollOperation(lroData.name, headers, onProgress);\n\t}\n\n\t// Try to get project ID from the response\n\tconst projectId = lroData.response?.cloudaicompanionProject?.id;\n\tif (projectId) {\n\t\treturn projectId;\n\t}\n\n\t// If no project ID from onboarding, fall back to env var\n\tif (envProjectId) {\n\t\treturn envProjectId;\n\t}\n\n\tthrow new Error(\n\t\t\"Could not discover or provision a Google Cloud project. \" +\n\t\t\t\"Try setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID environment variable. \" +\n\t\t\t\"See https://goo.gle/gemini-cli-auth-docs#workspace-gca\",\n\t);\n}\n\n/**\n * Get user email from the access token\n */\nasync function getUserEmail(accessToken: string): Promise<string | undefined> {\n\ttry {\n\t\tconst response = await fetch(\"https://www.googleapis.com/oauth2/v1/userinfo?alt=json\", {\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${accessToken}`,\n\t\t\t},\n\t\t});\n\n\t\tif (response.ok) {\n\t\t\tconst data = (await response.json()) as { email?: string };\n\t\t\treturn data.email;\n\t\t}\n\t} catch {\n\t\t// Ignore errors, email is optional\n\t}\n\treturn undefined;\n}\n\n/**\n * Refresh Google Cloud Code Assist token\n */\nexport async function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials> {\n\tconst { clientId, clientSecret } = getGeminiCliOAuthClient();\n\tconst response = await fetch(TOKEN_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n\t\tbody: new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tclient_secret: clientSecret,\n\t\t\trefresh_token: refreshToken,\n\t\t\tgrant_type: \"refresh_token\",\n\t\t}),\n\t});\n\n\tif (!response.ok) {\n\t\tconst error = await response.text();\n\t\tthrow new Error(`Google Cloud token refresh failed: ${error}`);\n\t}\n\n\tconst data = (await response.json()) as {\n\t\taccess_token: string;\n\t\texpires_in: number;\n\t\trefresh_token?: string;\n\t};\n\n\treturn {\n\t\trefresh: data.refresh_token || refreshToken,\n\t\taccess: data.access_token,\n\t\texpires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n\t\tprojectId,\n\t};\n}\n\n/**\n * Login with Gemini CLI (Google Cloud Code Assist) OAuth\n *\n * @param onAuth - Callback with URL and optional instructions\n * @param onProgress - Optional progress callback\n * @param onManualCodeInput - Optional promise that resolves with user-pasted redirect URL.\n *                            Races with browser callback - whichever completes first wins.\n */\nexport async function loginGeminiCli(\n\tonAuth: (info: { url: string; instructions?: string }) => void,\n\tonProgress?: (message: string) => void,\n\tonManualCodeInput?: () => Promise<string>,\n): Promise<OAuthCredentials> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst { clientId, clientSecret } = getGeminiCliOAuthClient();\n\n\t// Start local server for callback\n\tonProgress?.(\"Starting local server for OAuth callback...\");\n\tconst server = await startCallbackServer();\n\n\tlet code: string | undefined;\n\n\ttry {\n\t\t// Build authorization URL\n\t\tconst authParams = new URLSearchParams({\n\t\t\tclient_id: clientId,\n\t\t\tresponse_type: \"code\",\n\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\tscope: SCOPES.join(\" \"),\n\t\t\tcode_challenge: challenge,\n\t\t\tcode_challenge_method: \"S256\",\n\t\t\tstate: verifier,\n\t\t\taccess_type: \"offline\",\n\t\t\tprompt: \"consent\",\n\t\t});\n\n\t\tconst authUrl = `${AUTH_URL}?${authParams.toString()}`;\n\n\t\t// Notify caller with URL to open\n\t\tonAuth({\n\t\t\turl: authUrl,\n\t\t\tinstructions: \"Complete the sign-in in your browser.\",\n\t\t});\n\n\t\t// Wait for the callback, racing with manual input if provided\n\t\tonProgress?.(\"Waiting for OAuth callback...\");\n\n\t\tif (onManualCodeInput) {\n\t\t\t// Race between browser callback and manual input\n\t\t\tlet manualInput: string | undefined;\n\t\t\tlet manualError: Error | undefined;\n\t\t\tconst manualPromise = onManualCodeInput()\n\t\t\t\t.then((input) => {\n\t\t\t\t\tmanualInput = input;\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t})\n\t\t\t\t.catch((err) => {\n\t\t\t\t\tmanualError = err instanceof Error ? err : new Error(String(err));\n\t\t\t\t\tserver.cancelWait();\n\t\t\t\t});\n\n\t\t\tconst result = await server.waitForCode();\n\n\t\t\t// If manual input was cancelled, throw that error\n\t\t\tif (manualError) {\n\t\t\t\tthrow manualError;\n\t\t\t}\n\n\t\t\tif (result?.code) {\n\t\t\t\t// Browser callback won - verify state\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t} else if (manualInput) {\n\t\t\t\t// Manual input won\n\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = parsed.code;\n\t\t\t}\n\n\t\t\t// If still no code, wait for manual promise and try that\n\t\t\tif (!code) {\n\t\t\t\tawait manualPromise;\n\t\t\t\tif (manualError) {\n\t\t\t\t\tthrow manualError;\n\t\t\t\t}\n\t\t\t\tif (manualInput) {\n\t\t\t\t\tconst parsed = parseRedirectUrl(manualInput);\n\t\t\t\t\tif (parsed.state && parsed.state !== verifier) {\n\t\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t\t}\n\t\t\t\t\tcode = parsed.code;\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\t// Original flow: just wait for callback\n\t\t\tconst result = await server.waitForCode();\n\t\t\tif (result?.code) {\n\t\t\t\tif (result.state !== verifier) {\n\t\t\t\t\tthrow new Error(\"OAuth state mismatch - possible CSRF attack\");\n\t\t\t\t}\n\t\t\t\tcode = result.code;\n\t\t\t}\n\t\t}\n\n\t\tif (!code) {\n\t\t\tthrow new Error(\"No authorization code received\");\n\t\t}\n\n\t\t// Exchange code for tokens\n\t\tonProgress?.(\"Exchanging authorization code for tokens...\");\n\t\tconst tokenResponse = await fetch(TOKEN_URL, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t},\n\t\t\tbody: new URLSearchParams({\n\t\t\t\tclient_id: clientId,\n\t\t\t\tclient_secret: clientSecret,\n\t\t\t\tcode,\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t});\n\n\t\tif (!tokenResponse.ok) {\n\t\t\tconst error = await tokenResponse.text();\n\t\t\tthrow new Error(`Token exchange failed: ${error}`);\n\t\t}\n\n\t\tconst tokenData = (await tokenResponse.json()) as {\n\t\t\taccess_token: string;\n\t\t\trefresh_token: string;\n\t\t\texpires_in: number;\n\t\t};\n\n\t\tif (!tokenData.refresh_token) {\n\t\t\tthrow new Error(\"No refresh token received. Please try again.\");\n\t\t}\n\n\t\t// Get user email\n\t\tonProgress?.(\"Getting user info...\");\n\t\tconst email = await getUserEmail(tokenData.access_token);\n\n\t\t// Discover project\n\t\tconst projectId = await discoverProject(tokenData.access_token, onProgress);\n\n\t\t// Calculate expiry time (current time + expires_in seconds - 5 min buffer)\n\t\tconst expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\trefresh: tokenData.refresh_token,\n\t\t\taccess: tokenData.access_token,\n\t\t\texpires: expiresAt,\n\t\t\tprojectId,\n\t\t\temail,\n\t\t};\n\n\t\treturn credentials;\n\t} finally {\n\t\tserver.server.close();\n\t}\n}\n\nexport const geminiCliOAuthProvider: OAuthProviderInterface = {\n\tid: \"google-gemini-cli\",\n\tname: \"Google Cloud Code Assist (Gemini CLI)\",\n\tusesCallbackServer: true,\n\n\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\treturn loginGeminiCli(callbacks.onAuth, callbacks.onProgress, callbacks.onManualCodeInput);\n\t},\n\n\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\tconst creds = credentials as GeminiCredentials;\n\t\tif (!creds.projectId) {\n\t\t\tthrow new Error(\"Google Cloud credentials missing projectId\");\n\t\t}\n\t\treturn refreshGoogleCloudToken(creds.refresh, creds.projectId);\n\t},\n\n\tgetApiKey(credentials: OAuthCredentials): string {\n\t\tconst creds = credentials as GeminiCredentials;\n\t\treturn JSON.stringify({ token: creds.access, projectId: creds.projectId });\n\t},\n};\n"],"mappings":";;;AAiBA,IAAI,gBAAgE;AACpE,IAAI,qBAA2C;AAC/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,KAClF,sBAAqB,OAAO,aAAa,MAAM,MAAM;AACpD,iBAAgB,EAAE;EACjB;AAGH,MAAM,2BAA2B;AACjC,MAAM,+BAA+B;AAErC,SAAS,0BAAsE;CAC9E,MAAM,WAAW,QAAQ,IAAI,2BAA2B,MAAM;CAC9D,MAAM,eAAe,QAAQ,IAAI,+BAA+B,MAAM;AACtE,KAAI,CAAC,YAAY,CAAC,aACjB,OAAM,IAAI,MACT,oCAAoC,yBAAyB,OAAO,6BAA6B,GACjG;AAEF,QAAO;EAAE;EAAU;EAAc;;AAGlC,MAAM,eAAe;AACrB,MAAM,SAAS;CACd;CACA;CACA;CACA;AACD,MAAM,WAAW;AACjB,MAAM,YAAY;AAClB,MAAM,uBAAuB;;;;AAW7B,eAAe,sBAAwE;AACtF,KAAI,cAAe,QAAO;AAC1B,KAAI,mBACH,OAAM;AAEP,KAAI,cAAe,QAAO;AAC1B,OAAM,IAAI,MAAM,6DAA6D;;AAG9E,eAAe,sBAAmD;CACjE,MAAM,eAAe,MAAM,qBAAqB;AAEhD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI;EACJ,MAAM,qBAAqB,IAAI,SAAiD,gBAAgB;GAC/F,IAAI,UAAU;AACd,iBAAc,UAAU;AACvB,QAAI,QAAS;AACb,cAAU;AACV,gBAAY,MAAM;;IAElB;EAEF,MAAM,SAAS,cAAc,KAAK,QAAQ;GACzC,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,wBAAwB;AAE3D,OAAI,IAAI,aAAa,mBAAmB;IACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;IACzC,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;IAC3C,MAAM,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAE3C,QAAI,OAAO;AACV,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,2CAA2C,UAAU,QAAQ,CAAC;AACrF;;AAGD,QAAI,QAAQ,OAAO;AAClB,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,iBAAiB,8DAA8D,CAAC;AACxF,kBAAa;MAAE;MAAM;MAAO,CAAC;WACvB;AACN,SAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,SAAI,IAAI,eAAe,mCAAmC,CAAC;;UAEtD;AACN,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,CAAC;AAClE,QAAI,IAAI,eAAe,4BAA4B,CAAC;;IAEpD;AAEF,SAAO,GAAG,UAAU,QAAQ;AAC3B,UAAO,IAAI;IACV;AAEF,SAAO,OAAO,MAAM,mBAAmB;AACtC,WAAQ;IACP;IACA,kBAAkB;AACjB,kBAAa,KAAK;;IAEnB,mBAAmB;IACnB,CAAC;IACD;GACD;;;;;AAMH,SAAS,iBAAiB,OAAkD;CAC3E,MAAM,QAAQ,MAAM,MAAM;AAC1B,KAAI,CAAC,MAAO,QAAO,EAAE;AAErB,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,SAAO;GACN,MAAM,IAAI,aAAa,IAAI,OAAO,IAAI,KAAA;GACtC,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,KAAA;GACxC;SACM;AAEP,SAAO,EAAE;;;AAsBX,MAAM,YAAY;AAClB,MAAM,cAAc;AACpB,MAAM,gBAAgB;;;;AAWtB,SAAS,KAAK,IAA2B;AACxC,QAAO,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;;;;;AAMzD,SAAS,eAAe,cAA6E;AACpG,KAAI,CAAC,gBAAgB,aAAa,WAAW,EAAG,QAAO,EAAE,IAAI,aAAa;AAE1E,QADoB,aAAa,MAAM,MAAM,EAAE,UAC7B,IAAI,EAAE,IAAI,aAAa;;AAG1C,SAAS,oBAAoB,SAA2B;AACvD,KAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,KAAI,EAAE,WAAW,SAAU,QAAO;CAClC,MAAM,QAAS,QAAmC;AAClD,KAAI,CAAC,OAAO,WAAW,CAAC,MAAM,QAAQ,MAAM,QAAQ,CAAE,QAAO;AAC7D,QAAO,MAAM,QAAQ,MAAM,WAAW,OAAO,WAAW,2BAA2B;;;;;AAMpF,eAAe,cACd,eACA,SACA,YACwC;CACxC,IAAI,UAAU;AACd,QAAO,MAAM;AACZ,MAAI,UAAU,GAAG;AAChB,gBAAa,6CAA6C,UAAU,EAAE,MAAM;AAC5E,SAAM,KAAK,IAAK;;EAGjB,MAAM,WAAW,MAAM,MAAM,GAAG,qBAAqB,cAAc,iBAAiB;GACnF,QAAQ;GACR;GACA,CAAC;AAEF,MAAI,CAAC,SAAS,GACb,OAAM,IAAI,MAAM,6BAA6B,SAAS,OAAO,GAAG,SAAS,aAAa;EAGvF,MAAM,OAAQ,MAAM,SAAS,MAAM;AACnC,MAAI,KAAK,KACR,QAAO;AAGR,aAAW;;;;;;AAOb,eAAe,gBAAgB,aAAqB,YAAyD;CAE5G,MAAM,eAAe,QAAQ,IAAI,wBAAwB,QAAQ,IAAI;CAErE,MAAM,UAAU;EACf,eAAe,UAAU;EACzB,gBAAgB;EAChB,cAAc;EACd,qBAAqB;EACrB;AAGD,cAAa,qDAAqD;CAClE,MAAM,eAAe,MAAM,MAAM,GAAG,qBAAqB,6BAA6B;EACrF,QAAQ;EACR;EACA,MAAM,KAAK,UAAU;GACpB,yBAAyB;GACzB,UAAU;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,aAAa;IACb;GACD,CAAC;EACF,CAAC;CAEF,IAAI;AAEJ,KAAI,CAAC,aAAa,IAAI;EACrB,IAAI;AACJ,MAAI;AACH,kBAAe,MAAM,aAAa,OAAO,CAAC,MAAM;UACzC;AACP,kBAAe,KAAA;;AAGhB,MAAI,oBAAoB,aAAa,CACpC,QAAO,EAAE,aAAa,EAAE,IAAI,eAAe,EAAE;OACvC;GACN,MAAM,YAAY,MAAM,aAAa,MAAM;AAC3C,SAAM,IAAI,MAAM,0BAA0B,aAAa,OAAO,GAAG,aAAa,WAAW,IAAI,YAAY;;OAG1G,QAAQ,MAAM,aAAa,MAAM;AAIlC,KAAI,KAAK,aAAa;AACrB,MAAI,KAAK,wBACR,QAAO,KAAK;AAGb,MAAI,aACH,QAAO;AAER,QAAM,IAAI,MACT,iKAEA;;CAKF,MAAM,SADO,eAAe,KAAK,aACd,EAAE,MAAM;AAE3B,KAAI,WAAW,aAAa,CAAC,aAC5B,OAAM,IAAI,MACT,iKAEA;AAGF,cAAa,qEAAqE;CAIlF,MAAM,cAAuC;EAC5C;EACA,UAAU;GACT,SAAS;GACT,UAAU;GACV,YAAY;GACZ;EACD;AAED,KAAI,WAAW,aAAa,cAAc;AACzC,cAAY,0BAA0B;AACrC,cAAY,SAAqC,cAAc;;CAIjE,MAAM,kBAAkB,MAAM,MAAM,GAAG,qBAAqB,0BAA0B;EACrF,QAAQ;EACR;EACA,MAAM,KAAK,UAAU,YAAY;EACjC,CAAC;AAEF,KAAI,CAAC,gBAAgB,IAAI;EACxB,MAAM,YAAY,MAAM,gBAAgB,MAAM;AAC9C,QAAM,IAAI,MAAM,uBAAuB,gBAAgB,OAAO,GAAG,gBAAgB,WAAW,IAAI,YAAY;;CAG7G,IAAI,UAAW,MAAM,gBAAgB,MAAM;AAG3C,KAAI,CAAC,QAAQ,QAAQ,QAAQ,KAC5B,WAAU,MAAM,cAAc,QAAQ,MAAM,SAAS,WAAW;CAIjE,MAAM,YAAY,QAAQ,UAAU,yBAAyB;AAC7D,KAAI,UACH,QAAO;AAIR,KAAI,aACH,QAAO;AAGR,OAAM,IAAI,MACT,uMAGA;;;;;AAMF,eAAe,aAAa,aAAkD;AAC7E,KAAI;EACH,MAAM,WAAW,MAAM,MAAM,0DAA0D,EACtF,SAAS,EACR,eAAe,UAAU,eACzB,EACD,CAAC;AAEF,MAAI,SAAS,GAEZ,SAAO,MADa,SAAS,MAAM,EACvB;SAEN;;;;;AAST,eAAsB,wBAAwB,cAAsB,WAA8C;CACjH,MAAM,EAAE,UAAU,iBAAiB,yBAAyB;CAC5D,MAAM,WAAW,MAAM,MAAM,WAAW;EACvC,QAAQ;EACR,SAAS,EAAE,gBAAgB,qCAAqC;EAChE,MAAM,IAAI,gBAAgB;GACzB,WAAW;GACX,eAAe;GACf,eAAe;GACf,YAAY;GACZ,CAAC;EACF,CAAC;AAEF,KAAI,CAAC,SAAS,IAAI;EACjB,MAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAM,IAAI,MAAM,sCAAsC,QAAQ;;CAG/D,MAAM,OAAQ,MAAM,SAAS,MAAM;AAMnC,QAAO;EACN,SAAS,KAAK,iBAAiB;EAC/B,QAAQ,KAAK;EACb,SAAS,KAAK,KAAK,GAAG,KAAK,aAAa,MAAO,MAAS;EACxD;EACA;;;;;;;;;;AAWF,eAAsB,eACrB,QACA,YACA,mBAC4B;CAC5B,MAAM,EAAE,UAAU,cAAc,MAAM,cAAc;CACpD,MAAM,EAAE,UAAU,iBAAiB,yBAAyB;AAG5D,cAAa,8CAA8C;CAC3D,MAAM,SAAS,MAAM,qBAAqB;CAE1C,IAAI;AAEJ,KAAI;AAiBH,SAAO;GACN,KAAK,GAJa,SAAS,GAAG,IAZR,gBAAgB;IACtC,WAAW;IACX,eAAe;IACf,cAAc;IACd,OAAO,OAAO,KAAK,IAAI;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,aAAa;IACb,QAAQ;IACR,CAEwC,CAAC,UAAU;GAKnD,cAAc;GACd,CAAC;AAGF,eAAa,gCAAgC;AAE7C,MAAI,mBAAmB;GAEtB,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,mBAAmB,CACvC,MAAM,UAAU;AAChB,kBAAc;AACd,WAAO,YAAY;KAClB,CACD,OAAO,QAAQ;AACf,kBAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACjE,WAAO,YAAY;KAClB;GAEH,MAAM,SAAS,MAAM,OAAO,aAAa;AAGzC,OAAI,YACH,OAAM;AAGP,OAAI,QAAQ,MAAM;AAEjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;cACJ,aAAa;IAEvB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,QAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;AAIf,OAAI,CAAC,MAAM;AACV,UAAM;AACN,QAAI,YACH,OAAM;AAEP,QAAI,aAAa;KAChB,MAAM,SAAS,iBAAiB,YAAY;AAC5C,SAAI,OAAO,SAAS,OAAO,UAAU,SACpC,OAAM,IAAI,MAAM,8CAA8C;AAE/D,YAAO,OAAO;;;SAGV;GAEN,MAAM,SAAS,MAAM,OAAO,aAAa;AACzC,OAAI,QAAQ,MAAM;AACjB,QAAI,OAAO,UAAU,SACpB,OAAM,IAAI,MAAM,8CAA8C;AAE/D,WAAO,OAAO;;;AAIhB,MAAI,CAAC,KACJ,OAAM,IAAI,MAAM,iCAAiC;AAIlD,eAAa,8CAA8C;EAC3D,MAAM,gBAAgB,MAAM,MAAM,WAAW;GAC5C,QAAQ;GACR,SAAS,EACR,gBAAgB,qCAChB;GACD,MAAM,IAAI,gBAAgB;IACzB,WAAW;IACX,eAAe;IACf;IACA,YAAY;IACZ,cAAc;IACd,eAAe;IACf,CAAC;GACF,CAAC;AAEF,MAAI,CAAC,cAAc,IAAI;GACtB,MAAM,QAAQ,MAAM,cAAc,MAAM;AACxC,SAAM,IAAI,MAAM,0BAA0B,QAAQ;;EAGnD,MAAM,YAAa,MAAM,cAAc,MAAM;AAM7C,MAAI,CAAC,UAAU,cACd,OAAM,IAAI,MAAM,+CAA+C;AAIhE,eAAa,uBAAuB;EACpC,MAAM,QAAQ,MAAM,aAAa,UAAU,aAAa;EAGxD,MAAM,YAAY,MAAM,gBAAgB,UAAU,cAAc,WAAW;EAG3E,MAAM,YAAY,KAAK,KAAK,GAAG,UAAU,aAAa,MAAO,MAAS;AAUtE,SAAO;GAPN,SAAS,UAAU;GACnB,QAAQ,UAAU;GAClB,SAAS;GACT;GACA;GAGiB;WACT;AACT,SAAO,OAAO,OAAO;;;AAIvB,MAAa,yBAAiD;CAC7D,IAAI;CACJ,MAAM;CACN,oBAAoB;CAEpB,MAAM,MAAM,WAA2D;AACtE,SAAO,eAAe,UAAU,QAAQ,UAAU,YAAY,UAAU,kBAAkB;;CAG3F,MAAM,aAAa,aAA0D;EAC5E,MAAM,QAAQ;AACd,MAAI,CAAC,MAAM,UACV,OAAM,IAAI,MAAM,6CAA6C;AAE9D,SAAO,wBAAwB,MAAM,SAAS,MAAM,UAAU;;CAG/D,UAAU,aAAuC;EAChD,MAAM,QAAQ;AACd,SAAO,KAAK,UAAU;GAAE,OAAO,MAAM;GAAQ,WAAW,MAAM;GAAW,CAAC;;CAE3E"}

package/dist/src/auth/oauth/vendor-pi-google/oauth-page.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-page.js","names":[],"sources":["../../../../../src/auth/oauth/vendor-pi-google/oauth-page.ts"],"sourcesContent":["const LOGO_SVG = `<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 800 800\" aria-hidden=\"true\"><path fill=\"#fff\" fill-rule=\"evenodd\" d=\"M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z\"/><path fill=\"#fff\" d=\"M517.36 400 H634.72 V634.72 H517.36 Z\"/></svg>`;\n\nfunction escapeHtml(value: string): string {\n\treturn value\n\t\t.replaceAll(\"&\", \"&amp;\")\n\t\t.replaceAll(\"<\", \"&lt;\")\n\t\t.replaceAll(\">\", \"&gt;\")\n\t\t.replaceAll('\"', \"&quot;\")\n\t\t.replaceAll(\"'\", \"&#39;\");\n}\n\nfunction renderPage(options: { title: string; heading: string; message: string; details?: string }): string {\n\tconst title = escapeHtml(options.title);\n\tconst heading = escapeHtml(options.heading);\n\tconst message = escapeHtml(options.message);\n\tconst details = options.details ? escapeHtml(options.details) : undefined;\n\n\treturn `<!doctype html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>${title}</title>\n  <style>\n    :root {\n      --text: #fafafa;\n      --text-dim: #a1a1aa;\n      --page-bg: #09090b;\n      --font-sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, \"Noto Sans\", sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\", \"Noto Color Emoji\";\n      --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace;\n    }\n    * { box-sizing: border-box; }\n    html { color-scheme: dark; }\n    body {\n      margin: 0;\n      min-height: 100vh;\n      display: flex;\n      align-items: center;\n      justify-content: center;\n      padding: 24px;\n      background: var(--page-bg);\n      color: var(--text);\n      font-family: var(--font-sans);\n      text-align: center;\n    }\n    main {\n      width: 100%;\n      max-width: 560px;\n      display: flex;\n      flex-direction: column;\n      align-items: center;\n      justify-content: center;\n    }\n    .logo {\n      width: 72px;\n      height: 72px;\n      display: block;\n      margin-bottom: 24px;\n    }\n    h1 {\n      margin: 0 0 10px;\n      font-size: 28px;\n      line-height: 1.15;\n      font-weight: 650;\n      color: var(--text);\n    }\n    p {\n      margin: 0;\n      line-height: 1.7;\n      color: var(--text-dim);\n      font-size: 15px;\n    }\n    .details {\n      margin-top: 16px;\n      font-family: var(--font-mono);\n      font-size: 13px;\n      color: var(--text-dim);\n      white-space: pre-wrap;\n      word-break: break-word;\n    }\n  </style>\n</head>\n<body>\n  <main>\n    <div class=\"logo\">${LOGO_SVG}</div>\n    <h1>${heading}</h1>\n    <p>${message}</p>\n    ${details ? `<div class=\"details\">${details}</div>` : \"\"}\n  </main>\n</body>\n</html>`;\n}\n\nexport function oauthSuccessHtml(message: string): string {\n\treturn renderPage({\n\t\ttitle: \"Authentication successful\",\n\t\theading: \"Authentication successful\",\n\t\tmessage,\n\t});\n}\n\nexport function oauthErrorHtml(message: string, details?: string): string {\n\treturn renderPage({\n\t\ttitle: \"Authentication failed\",\n\t\theading: \"Authentication failed\",\n\t\tmessage,\n\t\tdetails,\n\t});\n}\n"],"mappings":";AAAA,MAAM,WAAW;AAEjB,SAAS,WAAW,OAAuB;AAC1C,QAAO,MACL,WAAW,KAAK,QAAQ,CACxB,WAAW,KAAK,OAAO,CACvB,WAAW,KAAK,OAAO,CACvB,WAAW,MAAK,SAAS,CACzB,WAAW,KAAK,QAAQ;;AAG3B,SAAS,WAAW,SAAwF;CAC3G,MAAM,QAAQ,WAAW,QAAQ,MAAM;CACvC,MAAM,UAAU,WAAW,QAAQ,QAAQ;CAC3C,MAAM,UAAU,WAAW,QAAQ,QAAQ;CAC3C,MAAM,UAAU,QAAQ,UAAU,WAAW,QAAQ,QAAQ,GAAG,KAAA;AAEhE,QAAO;;;;;WAKG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8DO,SAAS;UACvB,QAAQ;SACT,QAAQ;MACX,UAAU,wBAAwB,QAAQ,UAAU,GAAG;;;;;AAM7D,SAAgB,iBAAiB,SAAyB;AACzD,QAAO,WAAW;EACjB,OAAO;EACP,SAAS;EACT;EACA,CAAC;;AAGH,SAAgB,eAAe,SAAiB,SAA0B;AACzE,QAAO,WAAW;EACjB,OAAO;EACP,SAAS;EACT;EACA;EACA,CAAC"}

package/dist/src/auth/oauth/vendor-pi-google/pkce.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.js","names":[],"sources":["../../../../../src/auth/oauth/vendor-pi-google/pkce.ts"],"sourcesContent":["/**\n * PKCE utilities using Web Crypto API.\n * Works in both Node.js 20+ and browsers.\n */\n\n/**\n * Encode bytes as base64url string.\n */\nfunction base64urlEncode(bytes: Uint8Array): string {\n\tlet binary = \"\";\n\tfor (const byte of bytes) {\n\t\tbinary += String.fromCharCode(byte);\n\t}\n\treturn btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n}\n\n/**\n * Generate PKCE code verifier and challenge.\n * Uses Web Crypto API for cross-platform compatibility.\n */\nexport async function generatePKCE(): Promise<{ verifier: string; challenge: string }> {\n\t// Generate random verifier\n\tconst verifierBytes = new Uint8Array(32);\n\tcrypto.getRandomValues(verifierBytes);\n\tconst verifier = base64urlEncode(verifierBytes);\n\n\t// Compute SHA-256 challenge\n\tconst encoder = new TextEncoder();\n\tconst data = encoder.encode(verifier);\n\tconst hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n\tconst challenge = base64urlEncode(new Uint8Array(hashBuffer));\n\n\treturn { verifier, challenge };\n}\n"],"mappings":";;;;;;;;AAQA,SAAS,gBAAgB,OAA2B;CACnD,IAAI,SAAS;AACb,MAAK,MAAM,QAAQ,MAClB,WAAU,OAAO,aAAa,KAAK;AAEpC,QAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG;;;;;;AAO9E,eAAsB,eAAiE;CAEtF,MAAM,gBAAgB,IAAI,WAAW,GAAG;AACxC,QAAO,gBAAgB,cAAc;CACrC,MAAM,WAAW,gBAAgB,cAAc;CAI/C,MAAM,OAAO,IADO,aACA,CAAC,OAAO,SAAS;CACrC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAG9D,QAAO;EAAE;EAAU,WAFD,gBAAgB,IAAI,WAAW,WAAW,CAEhC;EAAE"}